fix: download pre-built CLI from GitHub release when local build fails (#728)

Root cause: bun install creates empty directories in proot (Termux)
because proot can't intercept bun's symlink/hardlink/copy_file_range
syscalls. This breaks both local build and source-mode fallback.

Fix: when `bun run build` fails, download the pre-built cli.js from
the `cli-latest` GitHub release. The bundled binary is self-contained
(80KB, all deps inlined) and only needs the bun runtime.

- Add CI workflow (.github/workflows/cli-release.yml) that builds and
  uploads cli.js to a rolling `cli-latest` release on every push to main
- Replace broken source-mode fallback with GitHub release download
- Bump CLI version to 0.2.63

Co-authored-by: Sprite <noreply@sprite.dev>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/cli-release.yml

@@ -0,0 +1,55 @@
+name: CLI Release
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'cli/src/**'
+      - 'cli/package.json'
+      - 'cli/bun.lock'
+
+jobs:
+  build:
+    name: Build and release CLI
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies and build
+        working-directory: cli
+        run: |
+          bun install
+          bun run build
+
+      - name: Get version
+        id: version
+        working-directory: cli
+        run: echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"
+
+      - name: Update cli-latest release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Delete existing release if present
+          gh release delete cli-latest --yes 2>/dev/null || true
+          git tag -d cli-latest 2>/dev/null || true
+          git push origin :refs/tags/cli-latest 2>/dev/null || true
+
+          # Create new release with built cli.js
+          gh release create cli-latest \
+            --title "CLI v${{ steps.version.outputs.version }}" \
+            --notes "Pre-built CLI binary (auto-updated on every push to main).
+
+          This release is used as a fallback by \`install.sh\` when the local build fails (e.g. Termux proot).
+
+          **Version:** ${{ steps.version.outputs.version }}
+          **Built:** $(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            --prerelease \
+            cli/cli.js